Source/WebCore/ChangeLog

 12017-03-05 Chris Dumez <cdumez@apple.com>
 2
 3 Using <form> in <template> causes following <form> to get swallowed
 4 https://bugs.webkit.org/show_bug.cgi?id=163552
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 As per the HTML specification [1], when finding a "form" tag in the "in body"
 9 insertion mode, we should insert an HTML element for the token, and, if there
 10 is no template element on the stack of open elements, set the form element
 11 pointer to point to the element created.
 12
 13 We were missing the "if there is no template element on the stack of open
 14 elements" check and setting the form element pointer unconditionally.
 15 This patch fixes the issue.
 16
 17 [1] https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody:form-element-pointer-2
 18
 19 Test: fast/parser/form-after-template.html
 20
 21 * html/parser/HTMLConstructionSite.cpp:
 22 (WebCore::HTMLConstructionSite::insertHTMLFormElement):
 23
1242017-03-04 Simon Fraser <simon.fraser@apple.com>
225
326 Clarify some terminology in RenderLayerBacking

Source/WebCore/html/parser/HTMLConstructionSite.cpp

@@void HTMLConstructionSite::insertHTMLBodyElement(AtomicHTMLToken&& token)
476476void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken&& token, bool isDemoted)
477477{
478478 auto element = createHTMLElement(token);
479  m_form = &downcast<HTMLFormElement>(element.get());
480  m_form->setDemoted(isDemoted);
481  attachLater(currentNode(), *m_form);
482  m_openElements.push(HTMLStackItem::create(*m_form, WTFMove(token)));
 479 auto& formElement = downcast<HTMLFormElement>(element.get());
 480 // If there is no template element on the stack of open elements, set the
 481 // form element pointer to point to the element created.
 482 if (!openElements().hasTemplateInHTMLScope())
 483 m_form = &formElement;
 484 formElement.setDemoted(isDemoted);
 485 attachLater(currentNode(), formElement);
 486 m_openElements.push(HTMLStackItem::create(formElement, WTFMove(token)));
483487}
484488
485489void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken&& token)

LayoutTests/ChangeLog

 12017-03-05 Chris Dumez <cdumez@apple.com>
 2
 3 Using <form> in <template> causes following <form> to get swallowed
 4 https://bugs.webkit.org/show_bug.cgi?id=163552
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Add layout test coverage.
 9
 10 * fast/parser/form-after-template-expected.html: Added.
 11 * fast/parser/form-after-template.html: Added.
 12
1132017-03-04 Commit Queue <commit-queue@webkit.org>
214
315 Unreviewed, rolling out r213379.

LayoutTests/fast/parser/form-after-template-expected.html

 1<!DOCTYPE html>
 2<html>
 3<body>
 4<p>Test that the form following a template element properly gets parsed.</p>
 5<form style="background-color:red;">
 6 <input type="text" /><button>Submit</button>
 7</form>
 8</body>
 9</html>

LayoutTests/fast/parser/form-after-template.html

 1<!DOCTYPE html>
 2<html>
 3<body>
 4<p>Test that the form following a template element properly gets parsed.</p>
 5<template><form></form></template>
 6<form style="background-color:red;">
 7 <input type="text" /><button>Submit</button>
 8</form>
 9</body>
 10</html>